apiserver_audit_log_maxsize_set.metadata.json

{
  "Provider": "kubernetes",
  "CheckID": "apiserver_audit_log_maxsize_set",
  "CheckTitle": "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate",
  "CheckType": [
    "Security",
    "Configuration"
  ],
  "ServiceName": "apiserver",
  "SubServiceName": "Auditing",
  "ResourceIdTemplate": "",
  "Severity": "medium",
  "ResourceType": "KubernetesAPIServer",
  "Description": "This check ensures that the Kubernetes API server is configured with an appropriate audit log file size limit. Setting --audit-log-maxsize to 100 MB or as per business requirements helps manage the size of log files and prevents them from growing excessively large.",
  "Risk": "Without an appropriate audit log file size limit, log files can grow excessively large, potentially leading to storage issues and difficulty in log analysis.",
  "RelatedUrl": "https://kubernetes.io/docs/concepts/cluster-administration/audit/",
  "Remediation": {
    "Code": {
      "CLI": "Edit the kube-apiserver configuration to set the --audit-log-maxsize argument to 100 MB or an appropriate size. Example: --audit-log-maxsize=100",
      "NativeIaC": "",
      "Other": "",
      "Terraform": ""
    },
    "Recommendation": {
      "Text": "Configure the API server audit log file size limit to 100 MB or as per your organization's requirements.",
      "Url": "https://kubernetes.io/docs/admin/kube-apiserver/"
    }
  },
  "Categories": [
    "Logging",
    "Compliance"
  ],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": "Adjust the audit log file size limit based on your organization's storage capabilities and logging requirements."
}